eQMS for Clinical Trials: What a Quality System Must Deliver in a GCP Environment and How Biotechs Should Choose One

1. What an eQMS must actually do in a clinical trial

ICH E6(R3) does not mandate an eQMS. It does require the sponsor to “implement an appropriate system to manage quality throughout all stages of the trial process” (3.10), and to set up QA and QC processes with documented procedures (3.11). For a Phase I/II biotech, that means six core functions:

• Document control: SOPs, plans and templates with versioning, review, approval and signature. Appendix C.2.1 expects records to be identifiable and version-controlled, naming authors, reviewers and approvers with date and signature. Non-trial-specific records such as SOPs and validation records may be held outside trial-specific repositories (C.2.12), which is exactly where the eQMS and the eTMF meet. Requirements for pure document management are covered in eDMS requirements for biotechs and CROs.
• Deviations and CAPA: where noncompliance could significantly affect participants’ rights, safety or the reliability of results, the sponsor should carry out root cause analysis, implement CAPA and confirm it works (3.12.2). QA should use risk-based strategies to find the causes of serious noncompliance so that corrective and preventive action can follow (3.11.1).
• Change control: changes to systems are validated on a risk basis and follow change control procedures (4.3.4(c)). The EMA expects a formal change control process with risk assessment and version control (EMA/INS/GCP/112288/2023, Annex 2, A2.10).
• Training: the sponsor must use qualified people (3.4). Anyone using computerised systems must be trained in them (4.3.2), and training must be documented and available for inspection (EMA guideline, 5.3).
• Supplier and CRO qualification: the sponsor assesses whether service providers are suitable and selects them (3.6.7). It needs access to their SOPs and performance metrics (3.6.8) and oversees transferred activities, including any subcontracting (3.6.9).
• Audits: audits are independent of monitoring, proportionate to risk and follow documented procedures setting out what is audited, how, how often and how it is reported (3.11.2, 3.11.2.2).

An eQMS does not replace these obligations. It makes them provable: every deviation is linked to its SOP, training and CAPA, and every approval carries an attributable audit trail entry.

2. The rules behind it (with exact references)

ICH E6(R3): what 3.10, 3.16 and section 4 actually say

ICH adopted the final E6(R3), comprising the Principles and Annex 1, on 6 January 2025. It has applied in the EU since 23 July 2025 (EMA/CHMP/ICH/135/1995, Step 5). The FDA issued it as final, non-binding guidance on 8 September 2025, and the Federal Register notice followed on 9 September 2025 (90 FR 43460, docket FDA-2023-D-1955). According to the ICH Efficacy Guidelines page, “Annex 2 was subsequently adopted on 3 June 2026”; ECA Academy reports CHMP adoption on 25 June 2026; and the EU’s ACT EU GCP modernisation page states that “Annex 2 comes into effect on 15 January 2027”. Annex 2, on decentralised and pragmatic trials, matters less for core eQMS requirements.

Correcting the section mapping: the sections named in the brief are right in substance but do not cover every eQMS function.

• 3.10 Quality Management: a system to manage quality across all trial stages, quality by design and critical-to-quality factors. Section 3.10.1 then sets out risk management: identification, evaluation, control, communication, review and reporting. Risks must explicitly be considered “across the processes and systems, including computerised systems” (3.10.1.1).
• 3.16 Data and Records: data handling (3.16.1), record keeping and retention (3.16.3) and record access (3.16.4). For system selection, 3.16.1(x) is central. The sponsor keeps a record of important computerised systems and their validation status (i), ensures validation, audit trails, user management, backup, disaster recovery and IT security are in place (ii), and keeps a record of authorised users with their roles and permissions (iii).
• 4 Data Governance – Investigator and Sponsor: 4.2 covers the data life cycle, including audit trails (4.2.2) and transfer and migration (4.2.5). 4.3 covers computerised systems: procedures, training, security, validation (4.3.4), system failure and user management (4.3.8).
• Also needed: CAPA, audits and service providers additionally require 3.6 (agreements and service providers), 3.9 (sponsor oversight), 3.11 (QA, QC and audit) and 3.12 (noncompliance, with root cause analysis and CAPA).

EU Regulation 536/2014 (Clinical Trials Regulation)

• Art. 47: sponsor and investigator ensure the trial follows the protocol and GCP.
• Art. 52: the sponsor reports serious breaches through the EU portal “without undue delay but not later than seven days” after becoming aware of them. In the eQMS, deviation management therefore needs a “potential serious breach” escalation with deadline tracking.
• Arts. 57–58: sponsor and investigator keep a trial master file and archive its content for at least 25 years after the trial ends. Archiving must keep the content complete, legible and available to authorities, and any changes must be traceable.
• Art. 71: the sponsor may delegate tasks by written contract but remains responsible.

21 CFR Part 11 (trials under a US IND)

• 11.10: controls for closed systems. These include validation (a), limited access (d), “secure, computer-generated, time-stamped audit trails” (e), authority checks (g), training (i) and control of system documentation (k).
• 11.50: the signature manifestation shows the name, date and time, and the meaning of the signature.
• 11.70: the signature is permanently linked to its record.
• 11.100: each signature is unique to one person and never reused or reassigned.

For detail, see our 21 CFR Part 11 electronic signatures guide.

EU GMP Annex 11

Annex 11 (EudraLex Vol. 4) is a GMP guideline, and the 2011 text remains in force. The European Commission and PIC/S published a full draft revision for consultation on 7 July 2025 (closing 7 October 2025), together with a revised Chapter 4 and a new Annex 22 on AI. In GCP inspections Annex 11 serves only as a reference. The governing document for clinical trials is the EMA guideline on computerised systems.

EMA Guideline on computerised systems and electronic data in clinical trials

Guideline EMA/INS/GCP/112288/2023 was adopted by the GCP IWG on 7 March 2023, published on 9 March 2023 and has applied since September 2023. Its scope explicitly names eTMFs and document management systems. These sections matter for eQMS selection:

• 4.10 and Annex 2 (validation): under A2.1 you may rely on the vendor’s validation documentation once you have assessed it, for example through an audit, but responsibility stays with the sponsor. Annex 2 also covers periodic review (A2.9) and change control (A2.10).
• 6.2 (audit trail): ordinary users must not be able to switch it off; it must be human-readable and fully exportable, and it records what, who, when and why.
• 5.4 and Annex 3 (user management): segregation of duties (A3.3), least privilege (A3.4) and no shared accounts (A3.5).
• 6.7 (cloud): the cloud provider must be qualified, data jurisdiction must be settled in the contract, and your own validation needs a test environment identical to production.
• Annex 1 (agreements): a vendor that will not support pre-qualification audits or inspections should not be used. The data storage location must be described, and access must be secured if the vendor becomes insolvent or you switch vendor.
• 6.10 (migration): validating a data migration deserves “no less focus” than validating the system itself.

3. Sponsor biotech or CRO: how the eQMS differs

• Sponsor biotech: the sponsor keeps overall responsibility, including for transferred activities (ICH E6(R3), Principle 10.1 and 3.6.6). Its eQMS must therefore centre on oversight: qualifying and auditing the CRO and vendors, a register of transferred tasks, an escalation route for serious breaches under Art. 52, and access to the TMF sections the CRO holds.
• CRO: every service provider should “implement appropriate quality management” and report relevant incidents to the sponsor (3.6.6). Existing QM processes are acceptable if they are fit for purpose for the trial (3.6.10). At system level the difference shows mainly in client segregation: permissions per sponsor and project, sponsor access to the eTMF, and readiness for client audits. The EMA guideline applies explicitly to service providers too.

For the CRO perspective in depth, see eQMS for CROs: GCP requirements.